Breachesby GlyphKaiser Foundation Health Plan
Disclosed Apr 12, 202413,400,000 affectedConfirmed
The covered entity (CE), Kaiser Foundation Health Plan, Inc., reported that it disclosed the protected health information (PHI) for up to 13,134,908 individuals while using third-party tracking technologies. The PHI involved clinical, demographic, and financial information. The CE notified HHS, affected individuals, and the media. In response to the breach, the CE: removed all third-party tracking technologies from its authenticated online platforms, trained or retrained workforce members, and implemented additional administrative safeguards.
What is known
| People affected | 13,400,000 (as reported to HHS) |
|---|---|
| Disclosed | Apr 12, 2024 |
| Discovered | May 31, 2023 |
| Happened | May 31, 2023 |
| Attack | Ransomware |
| Data exposed | NamesHealth |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
Notices filed
Other breaches at Kaiser Foundation Health Plan
Insider breachInsider exposed names and health records. Reported to the HHS archive.695 affectedInsuranceUSApr 6, 2022Insider breachInsider exposed names and health records. Reported to the HHS archive.515 affectedInsuranceUSNov 7, 2019Insider breachInsider exposed names and health records. Reported to the California AG.4,389 affectedHealthcareUSAug 31, 2017Lost or stolen device breachLost or stolen device exposed names and health records. Reported to the HHS archive.2,451 affectedHealthcareUSApr 22, 2016Breach, details not statedBreach notice filed with the California AG, details not stated.HealthcareUSSep 11, 2013Breach, details not statedBreach notice filed with the California AG, details not stated.HealthcareUSMar 16, 2012
History of this record
[] to ["names","health"]by backfillSource
empty to hhsby backfillSource
empty to 13400000by backfillSource
empty to The covered entity (CE), Kaiser Foundation Health Plan, Inc., reported that it disclosed the protected health information (PHI) for up to 13,134,908 individuals while using third-party tracking technologies. The PHI involved clinical, demogby backfillSource
unknown to ransomwareby backfillSource
empty to 2023-05-31by backfillSource
empty to 2023-05-31by backfillSource
First recordedby backfillSource
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.